Online business

California’s data sheriffs

Companies far beyond the Golden State will feel the impact of its new privacy law

HISTORY DOES not repeat but sometimes it rhymes. So, it seems, do efforts to protect netizens’ privacy. The European Union led the world with its General Data Protection Regulation (GDPR), which came into force in May 2018. That law shook up internet giants and global advertising firms, both of which had previously used—and at times abused—consumer data with little oversight. On December 11th India’s government introduced a bill that would force firms to handle data only with consumer consent and give the authorities sweeping access to them. The same day Scott Morrison, Australia’s prime minister, promised a review of privacy laws and said the competition authority will monitor how advertising is done on digital platforms. But the most important piece of legislation rhyming with GDPR right now is the California Consumer Privacy Act (CCPA), which comes into force on January 1st. To online businesses, it jars.

The Californian law copies some of the GDPR’s provisions. It gives consumers the right to know what online information is collected about them and how it is used, permits them to demand that their data be destroyed and to sue companies for data breaches. In some ways, the CCPA is looser than its European predecessor. It does not, for instance, insist that firms have a “legal basis” for collecting and using personal data or restrict the international transfer of data. It also stops short of demanding the appointment of corporate data-protection officers and assessments of projects’ data-protection risks. And whereas the GDPR lets individuals demand that private information about them be removed from the web under certain circumstances, the First Amendment makes this “right to be forgotten” a non-starter in America.

In other respects, though, California goes further than the EU. The CCPA adopts a broader definition of personal information (which extends to such things as internet cookies that…